Network penetration testing

A comprehensive network penetration test combines several activities. Not every engagement includes all of them — the scope is agreed up front — but a thorough assessment typically draws on:

• Network discovery and mapping — identifying the structure, perimeter, and third-party connections, and reviewing router, switch, and firewall configuration.
• Exploitation testing — attempting access first without credentials, then as a standard user, then as a privileged user, using what discovery revealed.
• Server and configuration audit — reviewing account policies, permissions, patch levels, audit logs, and known vulnerabilities on a sample of servers.
• DMZ review — auditing internet-facing servers and testing them from both the DMZ and internal perspectives.
• Firewall rule review — checking rules against business need, and flagging excessive access, conflicts, and weak configuration.
• IDS/IPS testing — confirming intrusion detection or prevention systems actually detect and defend, safely and repeatably.
• Wireless and workstation testing — assessing Wi-Fi security and what an unauthorised user at a desk could achieve.

External network testing starts from the internet with no access and measures your exposure to a stranger. Internal testing starts from inside — modelling a phished laptop, a rogue insider, or a compromised supplier — and measures how far a foothold could spread. Because a hard shell with a soft centre is such a common weakness, many organisations run both and treat them as complementary. The guides to external and internal testing cover each in detail, and the cloud guide covers infrastructure you run on AWS, Azure or Google Cloud.

A network test checks whether your design and configuration hold up in practice. The NCSC’s network security fundamentals and 10 Steps to Cyber Security set out the good practice a tester will look for: knowing your assets, restricting access to what each user needs, separating networks, protecting the perimeter, keeping systems updated and monitoring activity.

Some environments add rules of their own. PCI DSS requires network-layer testing of the cardholder data environment and of any segmentation used to reduce scope. Public sector systems may need a provider from the NCSC’s CHECK scheme.

Expect a clear scope agreed in advance, testing carried out by qualified professionals, and results that are technically reviewed and quality-assured before delivery. A good report ranks findings by severity, explains the business risk, and gives concrete remediation steps — and a good firm will walk you through the results and offer a retest once you have addressed them, so you can prove the fixes worked. See what a good report contains.